Data Processing Addendum

Where personal data is contained in requests you send through the Hosted Gateway, you are the controller (or, under Australian law, the entity that holds the information) and WUBBERY PTY LTD is the processor acting on your instructions. Your instructions are this addendum, the Customer Agreement, and the settings you record in the console.

This addendum applies from the moment you accept it, including during a free shadow run, and forms part of the Customer Agreement when you go live.

The Hosted Gateway forwards your request to the Provider you configured, using your own credentials. What that Provider stores, and for how long, is governed by your agreement with them, not by this addendum. WUBBERY never selects a Provider you have not configured.

We will give you 30 days' notice by email before adding a sub-processor that would process your Ledger data. You may object; if we cannot resolve the objection you may terminate under the Customer Agreement without penalty.

• Transport encryption on every connection to the Hosted Gateway and the console.
• WUBBERY tokens are stored as hashes; Provider credentials you supply per request are forwarded and not retained.
• Administrative actions are logged with the acting identity.
• Access to production is limited to WUBBERY personnel who need it, under named accounts.
• WUBBERY does not currently hold a SOC 2 or ISO 27001 certification and does not claim one. Ask us for the current security summary before a regulated deployment.

If we become aware of unauthorised access to, or loss of, data we process for you, we will notify the email on your account without undue delay and in any case within 72 hours of becoming aware, with what we know, what we are doing, and what you may need to do. Where the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) applies to you, we will give you what you need to assess and notify.

• You may read your Ledger at any time in the console and request the rows behind any invoice.
• You may ask us to correct or delete account data. Ledger and acceptance rows are retained for the periods stated because they are the record behind invoices and agreements; after those periods they are deleted.
• If a person whose data was in your traffic contacts us directly, we will refer them to you and assist you as reasonably needed, because the request and response bodies were never stored and there is nothing for us to return.
• We will assist you with any assessment or inquiry a regulator makes about the processing, at reasonable cost where the assistance goes beyond what this addendum describes.

The Hosted Gateway runs in Australia. Requests are forwarded to wherever your chosen Provider is. Site and console hosting, sign-in and payments use the sub-processors above, some of which operate outside Australia; each is bound by its own published data-protection terms.

When your account closes, WUBBERY tokens are revoked immediately, learned state is deleted within 30 days, and Ledger, audit and acceptance rows are deleted at the end of their retention periods. You may request an export of your Ledger before closure.

This addendum is governed by the law of Victoria, Australia. Each party complies with the Privacy Act 1988 (Cth) and, where it applies to you, any other privacy law, in respect of personal information handled under it.